The First Autonomous Ransomware Attack Is Confirmed, and Exploits Now Go Live in Under 24 Hours

Security teams have long been told that machine-speed attacks were coming. As of this month, they have a case file. Microsoft's annual threat report, published October 1, describes an environment where the gap between a flaw becoming known and a working exploit is now measured in hours, and where AI agents have begun running the entire attack chain with little human direction. The patch calendar most enterprises work to was built for a slower adversary.

The Exploit Window Shrank to Hours. The Patch Window Did Not.

The 2026 Microsoft Digital Defense Report says the median time from a vulnerability being discovered in the wild to being weaponized has fallen to well below 24 hours, while critical external vulnerabilities typically take enterprises 30 to 60 days to remediate. Volume compounds the problem: nearly 40,000 CVEs were published in the first half of 2026, putting the year on track to roughly double. Microsoft's research leads, Tanmay Ganacharya and Wes Malaby, summarize it bluntly: "AI is changing the physics of cybersecurity."

Identity remains the other main door. According to TechTimes' breakdown of the report, which covers July 2025 through June 2026, phishing accounted for 23% of observed intrusions, up from 7% the year before, and exploits of public-facing applications rose to 24% from 15%. Once inside on a valid account, attackers went on to harvest further credentials in 52.2% of cases. Microsoft also describes a controlled evaluation in which an AI model strung together 32 consecutive attack steps to reach full domain compromise.

JADEPUFFER Ran the Whole Playbook Without a Human at the Keyboard

The case that turns those projections into evidence came from Sysdig's Threat Research Team, which documented JADEPUFFER on July 1 as the first agentic ransomware operation. The agent entered through an internet-facing Langflow instance using CVE-2025-3248, an unauthenticated remote code execution flaw, then harvested cloud and AI provider credentials, found object storage still running on default credentials, and pivoted to a production configuration service through CVE-2021-29441, a years-old Nacos authentication bypass. It extracted 1,342 configuration items, encrypted them with a key it never stored, dropped the original tables, and left a ransom table in their place.

The tell was the speed and the self-correction. When a login attempt failed, the agent diagnosed the cause and shipped a corrected payload 31 seconds later. When a server returned XML instead of the JSON it expected, the next payload simply included an XML parser. Its code carried natural language comments explaining why it was prioritizing the largest database. Michael Clark, Sysdig's Director of Threat Research, wrote that "the skill floor for running ransomware has dropped to whatever it costs to run an agent."

The same actor appears in the cloud. Security Affairs reports that Microsoft, which tracks the group as Storm-3168, traced an Azure intrusion to two compromised service principals. Their credentials had been posted in plaintext in a public GitHub issue and later edited out, yet remained visible in the edit history. After 15.5 hours of quiet reconnaissance, the attacker ran more than 150 destructive or credential operations in 35 minutes, targeting over 100 storage accounts, a Key Vault, and a Function App. The core deletion took about seven minutes. Resource locks and deletion protection were what saved several of the storage accounts.

The Warning Signs Were Visible. Most Victims Still Never Fixed Them.

Black Kite's 2026 Ransomware Report counted 7,551 publicly disclosed victims between April 2025 and March 2026, a 24.9% rise and the fourth straight annual record, and also names JADEPUFFER as the first agentic ransomware. Its more useful finding is about warning signs: 93.5% of victims showed a meaningful spike in Black Kite's ransomware susceptibility score before their disclosure appeared, and 85.9% showed a month-over-month increase of 10% or more. The weaknesses also outlasted the attack. After the incident, 43.5% of victims still carried a vulnerability rated CVSS 9.0 or higher, and 30.8% still carried a known exploited vulnerability.

Put the sources side by side and the pattern is consistent. JADEPUFFER did not need a novel exploit. It needed an exposed AI tool, a default password, a years-old flaw, and credentials stored where an agent could read them. Those are the same gaps a monthly patch cycle and an annual access review leave open, and an agent that works around the clock finds them first. The defensive answer is less about matching the attacker's speed than about removing what it can reach in those first minutes.

• Pull AI orchestration tools off the internet. Langflow and similar platforms often run with code execution endpoints exposed. Put them behind authentication and network controls, and patch CVE-2025-3248 wherever it exists.
• Strip secrets from AI servers. JADEPUFFER harvested cloud and model provider keys from the host it landed on. Move them to a vault and scope each one to the narrowest role possible.
• Treat any exposed credential as burned. Microsoft's own guidance notes that redacting a leaked secret does not invalidate it. Rotate on exposure, and scan public repositories and issue trackers for your tenant identifiers.
• Turn on deletion protection for recovery assets. Resource locks were the only thing between Storm-3168 and several storage accounts. Apply them to backups, Key Vaults, and site recovery resources.
• Patch internet-facing systems by exposure, not by calendar. With weaponization inside a day, critical external flaws need a separate fast track measured in hours, with a compensating control when a patch cannot ship in time.
• Watch runtime behavior and outbound traffic. Bulk configuration reads, mass table drops, and new scheduled tasks calling external hosts are the signals Sysdig used. Alert on them and block unexpected egress.

The first autonomous ransomware case did not break anything that was well defended. It walked through doors that were already open, faster than any human crew could, and that is the measure every exposed system now has to meet.